Error text: `The subscription is not registered to use namespace 'Microsoft.ContainerService'` (or similar).
Fix:
```
az provider register --namespace Microsoft.ContainerService
az provider show --namespace Microsoft.ContainerService --query registrationState
```
Wait until `Registered` (can take minutes). Then retry.
Notes:
- **New subscriptions** register only a common subset. The first AKS, the first Key Vault with certain features, the first Data Factory in a sub all hit this.
- **Terraform/Bicep.** The azurerm provider can auto-register (`resource_provider_registrations = "core"`), but explicit registration in your bootstrap script is more predictable than relying on provider behavior.
- **Permission.** Registering needs Contributor on the subscription (or the specific `Microsoft.Resources/subscriptions/resourceGroups` write). A service principal with only resource-group scope cannot self-register; register from a broader identity first.
- **Do not confuse with feature flags.** Some services need both provider registration AND a preview feature flag (`az feature register`). If registration succeeds but creation still fails, check for a feature flag.
Verify: `az provider show` says Registered, then the original create command succeeds.